I have a post type called Fulfillments that has a custom front end solution our admins use to fulfill orders made in our system. The post type itself needs to only be visible to admin users as it contains sensitive customer information that should not be public.
Restricting this with Access was quite straightforward but after doing so we started running into another issue.
We run some scripts on WordPress cron jobs that poll that fulfillment information to send out reports. After restricting the access to the fulfillment post type these scripts began to fail. Looking closely at this we've found that something (we're pretty sure that it's Access) has added the following snippet to our WP_Query
AND wp_posts.post_type <> 'fulfillment'
Which causes our query to return no results and breaks the rest of the script.
The full WP_Query request generated with Access control active is below:
SELECT wp_posts.ID FROM wp_posts INNER JOIN wp_postmeta ON ( wp_posts.ID = wp_postmeta.post_id ) WHERE 1=1 AND (
( wp_postmeta.meta_key = 'wpcf-booking-reference' AND wp_postmeta.meta_value IN ('RN0N9AM','RHFTCW0','RCJEZ1D','RZGE0E6','R6WSB2K','RBHRZNN','RSBSGLN','RRU2KYG','RUSUWM8','R2LH0W1','RMCCTU1','RLUXH8L','R0AGB1U','RUNFQ91','RY1AYPQ','RWWAVQM','RQ97SGV','RS62MKJ','RJ11V3U','R05HQR9','RLWTL30','R0AUE6Z','R0E4MW1','RLBJUUR','RLERS4F','RMWTYWC','R0NDBUD','RL08NM6','RQQ5WMN','RJ0H1ZM','RTRY0N5','RT6TV11','RSGUAE1','RY3H64N','RWKBV8A','RVXVRFW','RH5G4F1','RTCHGKJ','RYSHHPQ','RRDD0WR','RVLNHSF','RC2VAPB','RHZU6J1','R1VBLWK','RS0YXCD','RPWQ7C0','R1GFDQ1','RTEM1EZ','RGRL3QD','RDDXYH0','RGWJAXK','RXJ7YM9','R391J7E','RKF31JY','RTDFSFX','RNPNY2E','RZR7Z1Z','R3FSW05','RVVZ151','RGH0PBA','RLT9KSC','R0TWVXG','RUNETGQ','RUK0MR6','RHZSRH6','RWJEZHA','RFC9N4K','RZNYTLH','RHZ17UK','RFXNWNQ','R6C6Z7A','R1KHMVP','RA57JLC','R0R2948','RBRBKUK','RQBFEDU','RUAELN2','RVR90W4','R0UDW2G','RYSE787','RMLUER9','RNE0WJE','RRJ9ENM','RNB48UR','R7JDXKC','RAY3JJN','RLVQ9TB') )
) AND wp_posts.post_type = 'fulfillment' AND (wp_posts.post_status = 'publish') AND wp_posts.post_type <> 'restaurant' AND wp_posts.post_type <> 'fulfillment' AND wp_posts.post_type <> 'restaurants-to-order' GROUP BY wp_posts.ID ORDER BY wp_posts.post_date DESC
What we need, is a way to continue blocking access to the fulfillments on the front end of the site but allow our cron code to still be able to query the post type. Any ideas?